Subprocessor List

Last Updated: September 28, 2026

Effective date: September 28, 2026. Version: 1.5.

These are the companies First Gear AI LLC uses to operate the Service. They may process the personal data described in our Privacy Policy and, for business customers with a Data Processing Addendum, the data described in Annex A of that addendum.

Change notice: at least 30 days before adding or replacing a subprocessor, by email to account owners and an update to this page.

About this version. Version 1.5 adds no subprocessor. It keeps a locked copy of a departing client’s data, free, until they ask us to delete it, matching the Privacy Policy, Security Overview and Data Processing Addendum. Version 1.4 REMOVES a subprocessor. HighLevel (GoHighLevel / LeadConnector) is no longer used by the Service and no longer receives anything, so it has been taken off the list below. The change notice above governs adding or replacing a subprocessor, because that is what puts your data somewhere new; removing one sends your data to fewer places and does not trigger it. Nothing else about this version changed.

Version 1.2 shortens how long we keep a free copy of a departing client’s data to the period stated in the Supabase entry below, the same change made that day across our Terms, Privacy Policy, Refund Policy, Security Overview and Data Processing Addendum. It adds no subprocessor.

Version 1.1 corrected the record rather than adding anything new. Resend and Anthropic were already processing data for us when version 1.0 published and should have been listed then. Naming them was a correction, not the addition of a subprocessor, so the 30 day notice above was not triggered by it. The Cloudflare and Supabase entries were also described more completely. Nothing was added to the Service and nothing changed about where your data goes.

Current Subprocessors

• Supabase, Inc. (United States) — database infrastructure. Supabase is the platform on which we build and host the dedicated database that runs your system, and it also backs account sign-in. Touches: everything you store in the database we host for you, plus account identifiers and instance registry metadata. We provision that dedicated database inside our own Supabase organization and we pay for it, so Supabase remains our subprocessor for that data for as long as we hold it. If you leave, the project stays up and you can download your data for 30 days from the day you cancel. When that window closes we keep your locked copy on Supabase, free, so you can take it or come back. Only your key opens it, and neither we nor Supabase can read it. Ask us to delete it and we will; then Supabase stops holding it for us.
• Stripe, Inc. (United States) — payment processing and fraud prevention at checkout and for subscription billing. Touches: billing contact and payment data. Card data is handled by Stripe; full card numbers never touch our systems. Payment processors are commonly treated as independent controllers for the payment transaction itself; we list Stripe here for transparency either way.
• Vercel Inc. (United States) — website and dashboard hosting and content delivery. Touches: technical connection data such as IP address and request logs, and hosted page content.
• Resend (United States) — transactional email delivery, sent from send.firstgear.ai. Touches: your email address and the contents of the messages we send you. Today those are your sign-in codes and the receipt telling you your system is ready. We do not use it for marketing email.
• Cloudflare, Inc. (United States) — DNS and edge network for firstgear.ai, and the default AI inference for the assistant on our public website. Touches: technical connection data such as IP address for traffic that passes its edge, and the text of messages you type into that website assistant together with the associated request metadata. That assistant is a feature of our marketing site and is separate from your own operator, which runs on your Anthropic account.
• Anthropic, PBC (United States) — AI inference in two narrow places we operate: the assistant on our public website when a request runs on Anthropic instead of Cloudflare, and the assistant inside shared rooms in the portal. Touches: the text of those messages and the associated request metadata. This is a different relationship from your own Claude subscription, which is not our subprocessor. See the section below, because the distinction matters.
• Plausible Analytics — privacy-focused website analytics. Cookieless, no personal data collected, no cross-site tracking. Touches: aggregate page-view data only.
• Google LLC (United States) — optional “Continue with Google” sign-in. Engaged only if you choose to sign in with a Google account. Touches: the email address and basic profile Google returns to authenticate you.

Anthropic Wears Two Hats, and Only One of Them Is Ours

Your Claude subscription is not our subprocessor. Anthropic is your direct vendor there. That subscription is between you and Anthropic, your conversations run under your own account, and your relationship with them is governed by their terms and their privacy policy, not ours. We provide the system prompt and the configuration; we do not sit in the middle of your Claude account. Anthropic publishes a standard data processing agreement at anthropic.com, and you can obtain it there directly.

Two features we run ourselves are a different matter. The assistant on our public website answers questions about First Gear AI before you have an account. It normally runs on Cloudflare, and it falls back to Anthropic when it has to. The assistant inside shared rooms in the portal runs on Anthropic. Both of those calls are made with our own API key, on our own account, not yours. For those two features Anthropic is our subprocessor, and it is listed above as one.

The practical difference: what you type into your own Claude is between you and Anthropic and never reaches us. What you type into the assistant on our website, or into a shared room, is processed by us and by the provider that answers it.

Not Subprocessors: the Tools You Connect Yourself

The other tools you connect, such as email, calendar, and file storage, remain your own vendor relationships. You choose what to connect, those agreements are yours, and you can disconnect at any time.

Contact Us

Questions about this list, or want to object to a new subprocessor? Contact us at hello@firstgear.ai.

First Gear AI LLC
5900 Balcones Drive STE 100
Austin, TX 78731